(1) Subject to Part 6, a data controller shall not collect personal data unless —
(a) the data is collected for a lawful purpose connected with a function or activity of the data controller; and
(b) the collection of the data is necessary for that purpose.
(2) Where a data controller collects personal data directly from a data subject, the data controller shall at the time of collecting the personal data ensure that the data subject concerned is informed of —
(a) the fact that the personal data is being collected;
(b) the purpose for which the personal data is being collected;
(c) the intended recipients of the personal data;
(d) the name and address of the data controller;
(e) whether or not the supply of the personal data by that data subject is voluntary or mandatory;
(f) the consequences for that data subject if all or any part of the requested personal data is not provided;
(g) whether or not the data collected will be further processed and whether or not the consent of the data subject would be required for the further processing; and
(h) the data subject's right of access to, the possibility of correction of and destruction of, the personal data to be provided.
(3) A data controller shall not be required to comply with subsection (2) —
(a) in respect of a data subject where —
(i) compliance with subsection (2) in respect of a second or subsequent collection will be to repeat, without any material difference, what was done to comply with that subsection in respect of the first collection, and
(ii) not more than 12 months have elapsed between the first collection and the second or subsequent collection.
(b) where —
(i) compliance is not reasonably practicable at the time of collection, provided that the data controller makes available to the data subject all the relevant information specified in subsection (2) as soon as practicable, or
(ii) the personal data is used in a form in which the data subject concerned cannot or could not reasonably expect to be identified.
(4) Where personal data is not collected directly from the data subject concerned, the data controller or any person acting on his or her behalf shall ensure that the data subject is informed of the matters specified in subsection (2).
(5) Subsection (3) does not operate to prevent a second or subsequent collection from becoming a first collection where the data controller has complied with subsection (2) in respect of the second or subsequent collection.